As we rely more and more on computers and computer networks, computing security becomes increasingly more important. We read in the newspaper about cyber criminals breaking into computers and computer networks and stealing critical information such as credit card and bank account information. We are always on the lookout for computer viruses that may attack and destroy information on our computers. Imagine the harm that could result if confidential computerized medical or personnel records are broken into and distributed over the Internet.
Much has been done to solve these problems. For example, tools have been developed that allow computers to communicate securely. In the context of the World Wide Web, a security protocol known as Secure Sockets Layer (SSL) provides both privacy (e.g., secrecy) and authentication (e.g., confidence that a computer's and/or user's asserted identity is true). The SSL technology has been built into most Internet browsers and web servers, and so has become widely available to protect electronic commerce and other sensitive communications.
The SSL protocol works by encrypting data passing between computers through use of encryption keys and associated encryption techniques. The SSL technology also provides secure authentication over a series of successive data exchanges. This authentication for example prevents an attacker from injecting his or her own computing device between already-communicating computers to intercept sensitive information and/or insert inauthentic information (e.g., substituting the attacker's own shipping address for that of a legitimate user) into the data stream being exchanged. See also a related Transport Layer Security (TLS) protocol that has become an Internet standard (RFC 2246).
FIG. 1 shows an example use of such security protocols. In the illustrative example shown, a user operating an input-output device 50 wants to communicate with computer 52. The user's device 50 (which may be a so-called “client”) has the SSL/TLS functionality in this example. The conventional computer 52 may or may not have this SSL/TLS functionality but it is nevertheless desired to provide secure communications between the user device and the computer. While it would be possible to modify the computer 52 to provide SSL/TLS capabilities, this may not always be practical or cost-effective.
An alternative approach shown in exemplary illustrative FIG. 1 is to introduce a security proxy server 54 between the user device 50 and the computer 52. Security proxy server 54 has the requisite SSL/TLS capabilities to communicate securely with the user device 50, and otherwise acts as a passthrough for the data content traveling between computer 52 and the user computer 50. In a particular example shown, the user device 50 and the security proxy server 54 establish a secure data communications session using the SSL/TLS, SSH or any other desired secure protocol. In this particular example, a negotiation process 56 is performed between the user computer 50 and the security proxy server 54. This negotiation process 56 results in negotiating a secure session including session encryption keys for use during the data exchange to follow.
Based upon the security parameters set up through the negotiation phase 56, the user computer 50 and security proxy server 54 establish a secure “tunnel” 58 over the network. This secure tunnel—which is in this example constructed using cryptography—provides a private, authenticable secure link for carrying the data between user device 50 and security proxy server 54. This secure tunnel 58 can be supported by an insecure network such as the Internet and yet still provide both privacy and authentication for communications between user device 50 and server 54.
To communicate with computer 52, user device 50 sends information through the secure tunnel 58 to the security proxy server 54. The security proxy server 54 extracts the received information and passes it along to computer 52 over a further communications link 60 (which in this case may be unencrypted and rely on physical security such as controlled access to a physical facility as well as a secure firewall). When computer 52 wants to send a message to the user device 50, it communicates the message to the security proxy server 54 over link 60. The security proxy server 54 in turn communicates the message via secure tunnel 58 to user device 50. While end-to-end security is not provided in this particular example, the arrangement shown is adequate and very useful for many situations where it is desirable to use a computing device 52 behind a firewall (which may be part of proxy server 54's functionality) that does not have SSL/TLS protocol capabilities.
These known security techniques and protocols have been widely successful and are very useful for allowing secure communications to proceed over an essentially insecure network such as the Internet. However, security problems remain requiring additional solutions.
One area that the Secure Sockets Layer and Transport Security Layer protocols do not directly address relates to certain authorization issues. User or computer authorization generally relates to granting or withholding privileges or permissions to access particular computers or computing functions. For example, in connection with an enterprise such as a company or any other organization large or small, there may be some confidential computerized information and/or functions that are restricted for access by only certain users or classes of users. For example, some enterprises have especially confidential data stored on a special server that only certain users are allowed to log into. In other contexts, access to certain software functionality may be limited to only certain authorized users. Even within a particular software application, it is commonplace for some functionality to be restricted to only certain classes of users (e.g., all can view data but only certain users can change the data).
Referring to the FIG. 1 example, it is not readily apparent how flexible secure authorization can be provided. Computer 52 typically thinks it is communicating with security proxy server 54—which in a sense acts as a secure “stand-in” for user device 50. Many different user devices 50 may share the same security proxy server 54. While the arrangement shown in FIG. 1 can certainly accommodate ordinary user name/password based computer 52 authorization functionality, it would be desirable to permit additional, more secure and flexible authorization management.
Preferred exemplary illustrative non-limiting embodiments solve these and other problems by introducing new authorization functionality within the security proxy server. Such authorization functionality may use tokens supplied to user devices by other trusted computers or agents such as a management server for example—these tokens specifying to the security proxy server which permissions and authorizations are being granted to particular users.
In one example non-limiting illustrative arrangement, a management server manufactures a secure, tamper-resistant token for a particular user specifying the permissions and authorizations that user possesses. The token may be in the form of a digitally-signed message specifying, for example, a particular computer and associated port number that the user is permitted to access. The management server delivers the token to the user, preferably over a secure communications session. When challenged, the user then presents the secure token to the security proxy server. The security proxy server examines the token to be sure it is authentic and has not be tampered with, and then extracts information contained in the token to determine the user's authorization to access a particular computer, particular port number and/or other resource. The security proxy server then establishes authorized communication with the authorized computing resource based on the information contained in the user's token, and thereafter may act in one embodiment as essentially a passthrough or proxy for permitting the user to access and communicate with the resource.
Non-limiting exemplary advantages and additional features of exemplary embodiments include:                The arrangement proves that the user is authorized by the management server or other trusted entity to access a computing resource indicated in the authorization token.        The arrangement hides the resource information. An attacker could learn how to access the security proxy server but is still not able to obtain the information needed to access the ultimate computing resource. The attacker can't reach past the security proxy server without a valid authorization token.        The authorization token may contain authorized user information. The security proxy server may log user information in a proxy server log file for monitoring and other purposes.        An administrator can configure the authorization token to expire after a predetermined time period. Different valid time periods may be used. This prevents the authorization token from being reused by an attacker or by a user who once had but no longer has authorization.        The session token can be reused within the time period, or the server can invalidate the token after it is used once.        